-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVSA-2010:145 http://www.mandriva.com/security/ _______________________________________________________________________ Package : libtiff Date : August 6, 2010 Affected: 2008.0, 2009.0, 2009.1, Corporate 4.0, Enterprise Server 5.0 _______________________________________________________________________ Problem Description: Multiple vulnerabilities has been discovered and corrected in libtiff: The TIFFYCbCrtoRGB function in LibTIFF 3.9.0 and 3.9.2, as used in ImageMagick, does not properly handle invalid ReferenceBlackWhite values, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image that triggers an array index error, related to downsampled OJPEG input. (CVE-2010-2595) Multiple integer overflows in the Fax3SetupState function in tif_fax3.c in the FAX3 decoder in LibTIFF before 3.9.3 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF file that triggers a heap-based buffer overflow (CVE-2010-1411). Integer overflow in the TIFFroundup macro in LibTIFF before 3.9.3 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted TIFF file that triggers a buffer overflow (CVE-2010-2065). The TIFFRGBAImageGet function in LibTIFF 3.9.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a TIFF file with an invalid combination of SamplesPerPixel and Photometric values (CVE-2010-2483). The TIFFVStripSize function in tif_strip.c in LibTIFF 3.9.0 and 3.9.2 makes incorrect calls to the TIFFGetField function, which allows remote attackers to cause a denial of service (application crash) via a crafted TIFF image, related to downsampled OJPEG input and possibly related to a compiler optimization that triggers a divide-by-zero error (CVE-2010-2597). The TIFFExtractData macro in LibTIFF before 3.9.4 does not properly handle unknown tag types in TIFF directory entries, which allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted TIFF file (CVE-2010-248). Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more: http://store.mandriva.com/product_info.php?cPath=149&products_id=490 The updated packages have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2595 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1411 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2065 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2483 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2597 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2481 _______________________________________________________________________ Updated Packages: Mandriva Linux 2008.0: 7f2c540142f1f0027e1af0bb5e5d6b9b 2008.0/i586/libtiff3-3.8.2-8.3mdv2008.0.i586.rpm 2fe28407ec2158370391fde6671ce887 2008.0/i586/libtiff3-devel-3.8.2-8.3mdv2008.0.i586.rpm a63c74c604a64147e98b578fb14d8bb1 2008.0/i586/libtiff3-static-devel-3.8.2-8.3mdv2008.0.i586.rpm c6f6793532e54f0f429b0d7f2fb5cc53 2008.0/i586/libtiff-progs-3.8.2-8.3mdv2008.0.i586.rpm 1e9fce7b929a3abe76cf3a64984e2768 2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm Mandriva Linux 2008.0/X86_64: ca769ee7dc0c489efa24b5bae4872324 2008.0/x86_64/lib64tiff3-3.8.2-8.3mdv2008.0.x86_64.rpm 9437088dbe56fdeffe279200b1252bc0 2008.0/x86_64/lib64tiff3-devel-3.8.2-8.3mdv2008.0.x86_64.rpm a36d2b3936381b0917169940751035e9 2008.0/x86_64/lib64tiff3-static-devel-3.8.2-8.3mdv2008.0.x86_64.rpm a754d8268b77e094829f46f4909253ed 2008.0/x86_64/libtiff-progs-3.8.2-8.3mdv2008.0.x86_64.rpm 1e9fce7b929a3abe76cf3a64984e2768 2008.0/SRPMS/libtiff-3.8.2-8.3mdv2008.0.src.rpm Mandriva Linux 2009.0: eca3a746733b5c1d336ecd334660f765 2009.0/i586/libtiff3-3.8.2-12.3mdv2009.0.i586.rpm 88afdbf2d9f57d887e7d88c0a47aa7cb 2009.0/i586/libtiff3-devel-3.8.2-12.3mdv2009.0.i586.rpm 42351524386fdf9f6f0db6a890f90d15 2009.0/i586/libtiff3-static-devel-3.8.2-12.3mdv2009.0.i586.rpm e2597dcb8dd52b9b9b89ed4a7e9a7457 2009.0/i586/libtiff-progs-3.8.2-12.3mdv2009.0.i586.rpm eb278dd00fcdba1a9a022b26b40b8f7b 2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm Mandriva Linux 2009.0/X86_64: a4dd4241cbf68a3800d955b56d96fc3a 2009.0/x86_64/lib64tiff3-3.8.2-12.3mdv2009.0.x86_64.rpm 15dfa93a715fea30f87d47957d405614 2009.0/x86_64/lib64tiff3-devel-3.8.2-12.3mdv2009.0.x86_64.rpm b90de01cd1f67c4b36a6a1a4478f40ae 2009.0/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdv2009.0.x86_64.rpm c39509d570099a3333dafb3c405be826 2009.0/x86_64/libtiff-progs-3.8.2-12.3mdv2009.0.x86_64.rpm eb278dd00fcdba1a9a022b26b40b8f7b 2009.0/SRPMS/libtiff-3.8.2-12.3mdv2009.0.src.rpm Mandriva Linux 2009.1: 470a637b4fcccd4e177f39ecfc1193da 2009.1/i586/libtiff3-3.8.2-13.2mdv2009.1.i586.rpm a7adcfce77932c3d26100ed29a3a82a1 2009.1/i586/libtiff3-devel-3.8.2-13.2mdv2009.1.i586.rpm 9699f07b73466260f2910bf714ce56c1 2009.1/i586/libtiff3-static-devel-3.8.2-13.2mdv2009.1.i586.rpm 858cd94ead532044b99a40d793e3fbab 2009.1/i586/libtiff-progs-3.8.2-13.2mdv2009.1.i586.rpm de1744758df19a271525d440d8e4016c 2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm Mandriva Linux 2009.1/X86_64: e05c9cf64635f733396650b1140b5613 2009.1/x86_64/lib64tiff3-3.8.2-13.2mdv2009.1.x86_64.rpm 002c8b1fff51881ac7181c14ec9b56b0 2009.1/x86_64/lib64tiff3-devel-3.8.2-13.2mdv2009.1.x86_64.rpm f426223cfecb243643bcf46d6fbe5634 2009.1/x86_64/lib64tiff3-static-devel-3.8.2-13.2mdv2009.1.x86_64.rpm d66754ae9d5351c4747fcc6c5eb3f4dc 2009.1/x86_64/libtiff-progs-3.8.2-13.2mdv2009.1.x86_64.rpm de1744758df19a271525d440d8e4016c 2009.1/SRPMS/libtiff-3.8.2-13.2mdv2009.1.src.rpm Corporate 4.0: 6464aada6be88ca85416e3522851ee1e corporate/4.0/i586/libtiff3-3.6.1-12.9.20060mlcs4.i586.rpm 00e9a5fa7a65674874338f6646996f84 corporate/4.0/i586/libtiff3-devel-3.6.1-12.9.20060mlcs4.i586.rpm b91ffa15bdc2bc7c5e8500a15594a0d7 corporate/4.0/i586/libtiff3-static-devel-3.6.1-12.9.20060mlcs4.i586.rpm fb0919db56d53a7994022b27dc4a987f corporate/4.0/i586/libtiff-progs-3.6.1-12.9.20060mlcs4.i586.rpm 3097d3095f2758050121bd7c1d274db2 corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm Corporate 4.0/X86_64: 320a589cc69ce0fbbdda5b0be55469d4 corporate/4.0/x86_64/lib64tiff3-3.6.1-12.9.20060mlcs4.x86_64.rpm 164bbdf3291573b99304d785b63aa4d8 corporate/4.0/x86_64/lib64tiff3-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm aaadd8deff51408f2d9ea7712202440e corporate/4.0/x86_64/lib64tiff3-static-devel-3.6.1-12.9.20060mlcs4.x86_64.rpm 669f636420cf955a797ecea72c0f4aa7 corporate/4.0/x86_64/libtiff-progs-3.6.1-12.9.20060mlcs4.x86_64.rpm 3097d3095f2758050121bd7c1d274db2 corporate/4.0/SRPMS/libtiff-3.6.1-12.9.20060mlcs4.src.rpm Mandriva Enterprise Server 5: 714eef6124b23c07d716a1088c961e8b mes5/i586/libtiff3-3.8.2-12.3mdvmes5.1.i586.rpm 4582318959daf3a89526f9e856d63b2a mes5/i586/libtiff3-devel-3.8.2-12.3mdvmes5.1.i586.rpm a1ecf2254bbf472db01724e8a69a5648 mes5/i586/libtiff3-static-devel-3.8.2-12.3mdvmes5.1.i586.rpm 6c67e9c5dab96a18ca157c60a61a04df mes5/i586/libtiff-progs-3.8.2-12.3mdvmes5.1.i586.rpm 111eeb73e8c6893434da73e58726f8f2 mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm Mandriva Enterprise Server 5/X86_64: 2908165921a479bd8765c5163857c1ba mes5/x86_64/lib64tiff3-3.8.2-12.3mdvmes5.1.x86_64.rpm d5414e97a052e6bbec454d2984088b2c mes5/x86_64/lib64tiff3-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm 9beda798ab71763f2cbc6c645f4a0eaa mes5/x86_64/lib64tiff3-static-devel-3.8.2-12.3mdvmes5.1.x86_64.rpm 553379c5478d919c1388e13a08a39858 mes5/x86_64/libtiff-progs-3.8.2-12.3mdvmes5.1.x86_64.rpm 111eeb73e8c6893434da73e58726f8f2 mes5/SRPMS/libtiff-3.8.2-12.3mdvmes5.1.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFMXAAdmqjQ0CJFipgRAiYVAKC4U2WZPi5dPJwlwu680NDP7rxjqwCguxkQ pwXhgfBlp5fm43Y0A/MZ+O8= =s+AF -----END PGP SIGNATURE-----